SolidCAM Listed by handala Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to list industrial software vendors on leak sites, turning specialized manufacturing tools into leverage points in a broader campaign of data theft and extortion. In this environment, even companies that sit one step removed from consumer data can find themselves publicly named, with limited public detail about what was taken or how many people might be affected.

On June 10, 2024, SolidCAM was listed by the handala ransomware group. The group claims it hacked the company and exfiltrated internal files. The number of people affected remains unknown, and public reporting has not confirmed the full scope or method of the intrusion. The listing itself is a claim that has not been independently verified in the available record.

Breaking down the breach

According to the reported summary, handala announced that it had compromised SolidCAM and removed internal files in a ransomware attack. The group’s own statement greets the company and describes SolidCAM as an on-premise computer-aided manufacturing program that governs CNC milling procedures, integrates with other CAM and CAD interfaces, and provides tools for milling and turning operations. Beyond that claim and the June 10, 2024 listing date, timing of the intrusion, the precise attack vector, the volume of data taken, and any ransom demand are undisclosed. No independent confirmation of the breach’s technical details has been included in the public facts available for this report.

The group behind it: handala

Handala is a publicly documented threat actor that has appeared repeatedly on ransomware and data-leak forums. The group typically claims responsibility for intrusions, posts victim names on dedicated leak sites, and asserts that it has stolen internal material. Its operations have often been framed in geopolitical terms, with a pattern of targeting organizations it associates with particular countries or sectors. In this case the group claims it “Hacked SolidCAM” and that internal files were exfiltrated; those statements remain attributions made by the actor rather than independently verified findings. Public knowledge of handala’s prior activity shows a preference for public naming and data-leak pressure, but no additional claims specific to SolidCAM beyond the listing and the brief description of the software appear in the facts.

Who is SolidCAM?

SolidCAM develops and sells computer-aided manufacturing software used to program CNC machine tools. The product is designed to run on-premise, to integrate with CAD systems, and to streamline milling and turning workflows for manufacturers. Organizations of this type typically maintain customer and partner contact records, licensing and support databases, engineering documentation, and internal operational files. A breach at a CAM vendor can therefore touch both the company’s own workforce and the manufacturing firms that rely on its software, even when the exact contents of any stolen archive remain unconfirmed. The consequential nature of the incident lies in the dual exposure of corporate intellectual property and the potential for secondary risk to customers who depend on the integrity of the software supply chain.

The information in question

The facts state that internal files were exfiltrated in a ransomware attack. No further breakdown of file types, employee or customer records, source code, or financial data has been disclosed. Companies that produce specialized manufacturing software commonly hold design files, configuration data, support tickets, and business correspondence; whether any of those categories were among the material handala claims to possess is unconfirmed. Public detail on the precise contents is therefore limited, and readers should treat any specific data-type assertions beyond “internal files” as unverified.

What's at stake

For individuals whose contact or account information may have been stored in SolidCAM systems, the practical risks include targeted phishing, credential stuffing, and social-engineering attempts that reference the company’s products or support processes. For the organization itself, the stakes include potential disruption of customer trust, possible regulatory notification obligations depending on jurisdiction, and the operational cost of investigating and containing an intrusion whose full extent is not yet public. Because the number of people affected is unknown and the exact data types remain limited to the description “internal files,” the concrete impact cannot be quantified from the available record. The listing alone, however, creates a window in which threat actors may attempt to exploit any residual access or to sell purported data on secondary markets.

Were you affected?

If you have used SolidCAM software, held a support or licensing account, or corresponded with the company, treat the listing as a prompt to review your own exposure rather than as proof that your personal data was taken. Practical first steps include:

• Change passwords for any accounts that reused credentials associated with SolidCAM services, and enable multi-factor authentication where available.
• Monitor email and financial accounts for unexpected messages that reference manufacturing software, CNC tools, or support tickets.
• Watch for phishing that impersonates SolidCAM or related vendors and avoid clicking unsolicited links or attachments.
• Run a free exposure scan of your email address against known breach data sets to see whether your information has already appeared in other incidents.

Public detail on this specific incident remains limited; continued monitoring of official company statements and reputable breach-notification channels is the most reliable way to learn whether further confirmation or remediation guidance is issued.

AICompiled with AI assistance from public sources and published under our editorial standards.